Using pam_nologin to Manage Maintenance Windows

You will programmatically disable user logins across the system during critical patch windows.

In this lesson, you will learn how to programmatically block user access to your system during maintenance windows by utilizing the pam_nologin module.

Understanding pam_nologin

When you need to perform critical system updates or database migrations, allowing users to log in can lead to data corruption or session inconsistencies. The pam_nologin module is a simple yet powerful gatekeeper designed for this exact scenario. When this module is active in the PAM stack, it checks for the existence of a specific file—typically /etc/nologin.

If the file exists, the module prevents any user from logging in, with the exception of the root user. Instead of authenticating, the system displays the contents of the /etc/nologin file to the user and denies them access.

Implementing the Maintenance Window

To use this during a patch window, follow these two steps:

Verify the PAM Configuration: Check your /etc/pam.d/nologin (or relevant service files like sshd or login) to ensure the module is included. It is usually placed in the auth section:
```
auth required pam_nologin.so
```
Trigger the Block: When you are ready to start maintenance, create the nologin file with a helpful message:
```
echo "System undergoing maintenance. Please try again after 02:00 UTC." > /etc/nologin
```

Once this file exists, non-root users attempting to SSH or login via TTY will be rejected instantly. The PAM module checks the existence of this file at the start of the authentication phase; because it is a required module, the authentication process will fail immediately if the file is present.

Restoring Access: Once your maintenance is complete, simply remove the file to re-enable standard login access:
```
rm /etc/nologin
```

By automating the creation and removal of this file, you can create consistent, safe maintenance windows that prevent users from disrupting your system updates while keeping the administrative superuser account free to perform the necessary work.

Key Takeaway: The pam_nologin module effectively enforces system-wide access restrictions during maintenance by verifying the presence of /etc/nologin and denying all non-root authentication attempts until the file is removed.